Executive brief
A vulnerability in the PostgreSQL 'refint' module allows a database user to execute unauthorized commands on the underlying server. This could lead to a complete takeover of the database server or the theft of sensitive data. Additionally, certain configurations could allow an attacker to perform unauthorized database operations through SQL injection.
Technical details
The PostgreSQL 'refint' module contains a stack-based buffer overflow (CWE-121) and is susceptible to SQL injection (CWE-89). An unprivileged database user can exploit the buffer overflow to execute arbitrary code with the privileges of the operating system user running the PostgreSQL service. Furthermore, if an application uses a user-controlled column as a 'refint' cascade primary key, an attacker can use SQL injection to execute arbitrary SQL commands with the privileges of the user performing the update. These issues are resolved in PostgreSQL versions 18.4, 17.10, 16.14, 15.18, and 14.23.
Affected products
- PostgreSQL PostgreSQL Before 18.4, 17.10, 16.14, 15.18, and 14.23
Timeline
- 2026-05-12: patched: Fixes released in multiple branches.
- 2026-05-14: disclosed: Public advisory published.